Tuesday, 26 September 2017

A Bosnian folk song tells the death
of a severely ill Ottoman Pasha. After hearing of the Pasha’s death, his wife
also passes away from sorrow. Now that the UK voted to leave
the European Union (EU) on 23 June 2016, will data protection laws also pass
away from sorrow after the UK leaves the EU?

The Data
Protection Act 1998 (DPA), which is the UK’s current key regulatory
regime for data protection, implements the EU’s Data
Protection Directive of 1995 into the UK national law. This Directive is replaced
by the General Data Protection Regulation (GDPR) adopted in April 2016, which introduces
a task force (European
Data Protection Board), new responsibilities
for data controllers and processors, and new
rights for data subjects such as right to transfer data from one server to
another and right to be forgotten. All EU Member States have to transpose this
Regulation by 25 May 2018 (before the UK is due to leave the EU). Accompanying
the GDPR, a new Directive
in relation to data protection in the field of police and justice sectors was also
introduced at the EU level. This Directive creates a comprehensive framework for
data processing activities performed for the prevention, investigation,
detection or prosecution of criminal offences or the execution of criminal
penalties, including the safeguarding against and the prevention of threats to
public security. All EU Member States have to transpose this Directive into
their national laws by 6 May 2018.

As an EU regulation, the GDPR
will be directly applicable in the UK without the need for an Act of Parliament
from 25 May 2018 forwards as the UK is expected to leave the EU officially some
point after March 2019 and its EU membership continues until then. Still, there
exists some provisions under the GDPR that Member States can adapt in their
national laws such as permitted derogations from data protection principles (Article
23 on derogations from transparency obligations and data subject rights for
purposes of national security, defence, public security etc., and Articles
85-91 on derogations for specific data processing situations such as necessary
for freedom of expression, employee data, and scientific and historical
research purposes). So, in anticipation of dealing with these issues, first, a
statement of intent was published by the UK Government on 7 August 2017 as
a form of commitment to the GDPR. Then, the Data
Protection Bill was introduced
to the House of Lords on 13 September 2017. (Also, see here
for the House of Lords’ report on Brexit and data protection). This Bill will
replace the Data Protection Act 1998,
and will regulate the areas where the UK has competence to do so such as the
permitted derogations mentioned above and areas that fall outside the scope of
the GDPR like data processing for law enforcement purposes or for national
security interests. So, in light of these recent developments, it is clear that
the data protection in the UK will not experience an immediate death.

The Data Protection Bill in a nutshell

As a whole, the Data Protection
Bill contains the general definitions under the GDPR and the derogations from
data protection principles provided under it. These derogations
include data processing for journalism, for research, and by employees under
certain conditions.

It also covers the areas that are
not covered by the GDPR. The first area is the data processing in the context
of law enforcement (Part 3 of the Data Protection Bill), which is in fact
covered by the Data Protection Directive on processing of personal data for law
enforcement purposes (the ‘Law Enforcement Directive’). Unlike the GPDR, this
Directive is not directly applicable in the UK.

Therefore, with the inclusion of
the data processing by competent public authorities in relation to law
enforcement purposes, the Data Protection Bill transposes the Law Enforcement Directive
into UK law. It is said
that the principles for such processing resembles the
2014 Regulations, through which the UK transposed the previous EU data
protection rules
for data processing in the context of law enforcement. On the basis of the
broad definition of a competent authority for data processing under the Bill, data
can be processed not only by criminal justice agencies in the UK, but also
other organisations with law enforcement functions such as such as Her
Majesty’s Revenue and Customs, the Health and Safety Executive and the Office
of the Information Commissioner. The competent authority definition under the
Law Enforcement Directive provides for such broad definition (Article 3(7) of
the Law Enforcement Directive). Another area that is covered by the Bill and
not by the GDPR is data processing for intelligence services (Part 4 of the Data
Protection Bill). It is said
that the provisions on this processing are based upon the Council of Europe’s
Convention on automatic processing of data (Convention
108) and changes
which are being made to that Convention [note 40 of the
Explanatory Notes for the Data Protection Bill]. This part of the Bill is
complementary to the other legislation in relation to intelligence services
such as the Investigatory
Powers Act 2016 (discussed below) [note 47], and therefore constantly
refers to this legislation. It also provides for national security exemptions
for certain provisions it sets forth for data processing by intelligence
services (Chapter 6 of the Part 4 of the Data Protection Bill).

Consequently, when the Data
Protection Bill receives Royal Assent (in principle, in May 2018 on the same
day the GPDR is due to be applicable) the GDPR, which will be converted to UK
law with the EU
(Withdrawal) Bill upon Brexit, has to read alongside the Data Protection Bill.
For references in the GDPR such as ‘Union law’ and ‘Member State law’ that will
be no longer relevant after Brexit, Schedule
6 of the Data Protection Bill introduces amendments.

The Data Protection Bill has
received both positive and negative comments. The positive
ones hinged on the relief it has brought to data controllers based in the UK.
That said, it is argued
that the Bill contains some complex and legally questionable provisions, like
this sentence: ‘Terms used in Chapter 2 and in the GDPR have the same meaning
in Chapter 2 as they have in the GDPR’ (Section 4). Or this sentence: ‘GDPR
applies to the processing of personal data to which this Chapter applies but as
if its Articles were part of an Act extending to England and Wales, Scotland
and Northern Ireland’ (Section 20(1)). Nevertheless, the second reading of the
Data Protection Bill in the House of Lords is due on 10 October 2017 and there
might be further changes to it before it becomes law.

What is at stake for the future of UK-EU cross-border data transfer
after Brexit?

For the importance of the UK-EU
cross-border data transfers the numbers speak for themselves. 43%
of EU tech companies are based in the UK and 75%
of the UK’s data transfers are with the EU Member States. It is for this reason
that the UK Government has consistently referred
to the importance of maintaining the data flow between the UK and the EU after
Brexit [note 8.38]. However, even if one assumes that the Data Protection Bill
successfully aligns UK law with the EU data protection framework, this does not
mean that the Bill is a panacea for the future of this flow post-Brexit. This
point was also accepted by the UK Government in their position
paper on the exchange and protection of personal data after Brexit [note 4].
Upon the UK’s exit from the EU, the UK will be considered as a third country
within the meaning of the abovementioned framework and any data transfer from
the EU to there will have to comply with the rules on data transfer to a third
country under the same framework.

Like the Data Protection
Directive of 1995, the GDPR allows for transfer of personal data outside the
EU/EEA, for instance if the European Commission decides that third country to
which data are transferred ensures an ‘adequate level of protection’ for those
data (Article 45 of the GDPR) or if the UK businesses (either as data
processors or controllers) individually adopt other adequacy mechanisms such as
standard contractual clauses and binding corporate rules (Articles 46 and 47 of
the GDPR). In its position
paper on the exchange and protection of personal data after Brexit, the UK
Government referred to the Article 45 adequacy finding and mentioned that the
future UK-EU data transfers could built upon this adequacy model [paras. 22,
32-41]. Moreover, it noted that the UK should be found as compliant with EU
data protection framework as it introduced the Data Protection Bill, which
implemented the GDPR and the Law Enforcement Directive [ibid, para. 23]. As
discussed below, achieving a positive adequacy decision for the UK is not as uncontentious
as the UK Government think it is.

At the outset, the UK should be
found to afford an adequate level of data protection, which was defined in the CJEU’s
Schrems
decision (discussed here)
as ‘essentially equivalent’ data protection to that of afforded under EU law. The
crux of this decision is that in the Court’s view, US law failed to offer that
level of protection because it included expansive national security derogations
for the use of personal data by the US intelligence agency, which in turn meant
that EU citizens were stripped of their privacy and data protection rights once
their data reached the shores of the US under the then valid Safe Harbour
principles scheme. It is evident from this decision that the activities of
intelligence agency of a third country with respect to personal data
transferred from the EU comes under the scrutiny of the European Commission in
its quest for an adequacy decision for that country. Indeed, the GDPR requires
the European Commission to consider a wide array of issues such as the rule of
law, respect for fundamental rights, and legislation on national security,
public security, and criminal law in that country (Article 45(2) of the GDPR). So,
the UK Government’s assumption that the implementation of the GDPR will suffice
for a positive adequacy finding for the UK is false because UK laws on data
processing by intelligence agencies’ for national security purposes will come
under the scrutiny of the European Commission.

Regretfully, the surveillance
practices of UK intelligence services may imperil a positive adequacy decision.
The discussions surrounding the Investigatory
Powers Act (IPA), and its predecessor the Data
Retention and Investigatory Act 2014 (DRIPA) is illustrative in this
matter. The latter Act provided for the storage of telecommunications’ data for
later to be used by police and security agencies. Following the CJEU’s Digital
Rights Ireland decision (discussed here)
finding practices of indiscriminate data retention in the context of fight
against terrorism and transnational crime incompatible with EU fundamental
rights of privacy and data protection, the DRIPA was challenged in the joined
cases of Tele2
and Watson before the CJEU on the ground that it provided for such
practices, and thus violated the mentioned rights. Consequently, the CJEU found
the DRIPA unlawful as the data retention scheme established under it exceeded
the limits of what is strictly necessary and was not justified. (See here
for Prof Lorna Woods’s take on the Tele2
and Watson decision).

The IPA, which took the place of
DRIPA, retains the contested provisions of the DRIPA, and in some situations
provides for more controversial data processing. For example, the IPA provides
for the retention of telecommunications data for preventing or detecting crime
or preventing disorder (Article 87(1) of the IPA), which does not comply with
the CJEU’s finding in Tele2 and Watson
that ‘only the objective of fighting serious crime is capable of justifying
such access to the retained data [para. 172]’. Therefore, the IPA sits at odds
with the CJEU’s finding in Tele2 and
Watson.

In fact, a legal
challenge to the IPA in this matter has already been brought before the UK
High Court by the UK based civil liberties organisation Liberty. Equally relevant
is that Investigatory Powers Tribunal referred the question on the
compatibility of the acquisition and use of bulk communications data under s.94
of the Telecommunications Act 1984
with EU law to the CJEU. (See here
for Matthew White’s review on the matter).

Here, the status of the EU
Charter of Fundamental Rights (Charter) and the jurisdiction of the CJEU after
Brexit requires further attention. The EU (Withdrawal) Bill provides that
pre-Brexit case-law of the CJEU stays binding after Brexit with certain
exceptions (Clause 6. When departing from pre-Brexit case-law of the CJEU, the
Supreme Court must apply the same test it applies when deciding whether to
depart from its own case law, and Parliament or the executive can override that
prior CJEU case law). However, the EU (Withdrawal) Bill in its current form excludes
the Charter (Clause 5(4)), and puts an end to the jurisdiction of the CJEU
(Clause 6) after Brexit. Still, this does not mean that the UK can ignore the
decisions of CJEU given after Brexit because the EU data protection framework,
which the European Commission will refer to when considering the adequacy
question, will be interpreted in light of those decisions. The UK Government,
on the other hand, seems to sweep these issues under the carpet in its
post-Brexit paper because neither the discussions surrounding the IPA nor the
case-law of the Charter after Brexit were mentioned in its position paper on
the exchange and protection of personal data. Only when dealing with the UK-EU
model of data exchange, it referred that such model should ‘respect UK
sovereignty, including the UK’s ability to protect the security of its citizens
and its ability to maintain and develop its position as a leader in data
protection [note
22.] This statement might be read as a reference to the IPA, or any future
law on surveillance practices and the end of the direct jurisdiction of the
CJEU.

Alternatives to the adequacy
finding under Article 45 of the GDPR include subjecting the data transfers to
safeguards under Article 46, which include Binding Corporate Rules under
Article 47. The Government already noted that these alternatives are not its
primary target due to their limited scope [Annex
A]. Still, as the ongoing challenge against the standard contractual clause
scheme for data transfers under the Data Protection Directive of 1995 shows,
neither alternative is immune from a legal challenge before the CJEU.

One might ask whether all these
will be relevant for the data transfer during the transitional period should
there be a transitional period after Brexit. The short answer is: yes, they
will be. Despite the UK Government’s discontent,
if the transitional period is based on the UK’s joining of the European
Economic Area (EEA) and the
European Free Trade Association (EFTA)– the so-called Norway option-, the
data will continue to flow from the EU without an adequacy decision by way of
retaining the GDPR as parts of UK law after Brexit since the GDPR has EEA
relevance (ie, non-EU EEA states will apply the GDPR as such).

Other than that, the UK may seek
to conclude a transitional agreement as part of the Article 50 negotiations, as
indicated in the Prime Minister’s recent Florence speech (discussed here).
That agreement will not be immune from the adequacy requirements discussed
above because it will have to match the EU standards, and particularly the EU
data protection framework and its rules on data transfers.

Data Protection in the field of police and justice sectors

As mentioned above, the UK aims
to transpose the Law Enforcement Directive in to UK law with the Data
Protection Bill. Yet, as in the case of GDPR, maintaining the data exchange
between law enforcement authorities in the UK and in the EU will not be
undisputed upon Brexit.

Any obstacle to this data
exchange after Brexit has been considered as a gift for criminals and as a threat for public safety.
So, it should not come as a surprise that the UK Government highlighted the
importance of facilitating this data exchange for cross-border law enforcement
cooperation in its position
paper on security, law enforcement, and criminal justice [note 21]. Just
like the GDPR, the Data Protection Directive on law enforcement requires an
adequate level of data protection standards for data transfers to a third
country (Article 36 of the Law Enforcement Directive). So, any future agreement
between the EU and the UK on law enforcement information exchange would have to
comply with these standards. The UK Government voiced its intention
to ‘build on’ the adequacy scheme for the future of data exchange for law
enforcement. Still, it was of the opinion that the implementation of the Law
Enforcement Directive through the introduction of the Data Protection Bill is
enough for the UK to secure a positive adequacy decision. I discussed earlier
the scope of the adequacy assessment and the matters that may affect the
likelihood of securing such decision. Besides, in the recent judgment
by the CJEU on the compatibility of the EU-Canada Agreement on transferring
passenger information in the fight against terrorism with the EU Treaties and
Charter, the Court set a list of procedural requirements for the transfer of
information in that context. In this regard, these requirements must be met for
law enforcement data transfers to be compatible with the Charter. (See here
Prof Lorna Wood’s review of Opinion 1/15.)

What is the EU’s position on data protection?

While all these developments and
discussions are unravelling in the UK, the EU’s position on the matter focuses
on the use and protection of personal data obtained or processed before Brexit
for good reason – the need to determine what happens to data processed before
Brexit Day. Accordingly, the EU Commission published a position
paper as part of its approach to Article 50 negotiations in relation to
such use and protection, updated on 21 September 2017. On the whole, the paper
provides for the continuity of the application of the general principles of the
EU data protection framework in force on Brexit day to personal data in the UK
processed before that day. It also notes the continuity of the principal data
subject rights’ such as right to be informed, right of access, and right to
rectification. Moreover, it seeks the confirmation that the personal data with
specific retention periods under sectorial laws must be erased upon the
exhaustion of those periods, and that the ongoing investigations in relation to
compliance with data protection principles on the Brexit day should be
completed. It does not go unnoticed that the paper mentions to the CJEU as the
legal authority to interpret the general principles that it refers to. As a
whole, the position paper indicates that amidst the ambiguousness and the
complexity that the future partnership with the UK on data protection holds,
the EU Commission seeks to secure that this uncharted water will not be
detrimental to data subjects whose data were transferred to the UK before
Brexit.

Conclusion

The UK Government introduced the
Data Protection Bill, which seeks to adjust its national laws on data
protection with the GDPR and the Law Enforcement Directive. This development
may mean that at least some EU data protection requirements will be implemented
in UK law on the day the UK leaves the EU. Still, it should not be read as a
solution for the issue of maintaining the UK-EU data transfer after Brexit
because the GDPR’s and the Directive’s provisions on third country data
transfer will be relevant for such transfer. After the CJEU’s Schrems decision, an adequacy finding
and other legal mechanisms to enable that movement could trigger the extent of
national security derogations and their interferences with fundamental rights
of the persons whose data are transferred from the EU to the UK. Certain
provisions of the IPA and the CJEU’s findings in Tele2 and Watson cannot be reconciled, and this may hinder a
positive adequacy finding for the UK. The same conclusion can be drawn for any
future EU-UK data transfer deal for law enforcement purposes.

Monday, 25 September 2017

The Prime Minister’s big speech
in Florence has received the most attention in recent weeks, but it’s also
worth looking at the UK government’s recent papers on its planned EU/UK close
partnership after Brexit. I’ll look here
at the papers on two aspects of security – external security (foreign policy
and defence) on the one hand, and internal security (police and criminal law
cooperation) on the other. Both of them are impacted in the short term by the Florence
speech, since the Prime Minister called for the current UK/EU security
arrangements to apply for a period of around two years, followed by a
comprehensive EU/UK security treaty. Assuming that such a transition period is
agreed, the issue is what happens after that. In other words, what will be the
content of that future comprehensive security treaty?

External security: Foreign policy and defence

The UK government's foreign
policy paper devotes much of its space – the first 17 pages – to explaining
the UK's major commitments in this field, including via its EU membership. A
Martian reader would assume that the UK was applying to join the Union. Only
the last few pages discuss the government’s preferred policy – which is both
rather vague and highly resembles EU membership.

In short (although there’s no
long version), the government seeks to maintain a relationship with the EU in
this field that’s closer than any other non-EU country – although without
offering many specifics. The government does, however, state that it wants to
contribute to EU defence missions and to align sanctions regimes with the EU. The
point about sanctions is particularly relevant, since the UK provides intelligence
to justify their imposition and some of the individuals concerned have placed
their assets in the UK.

For instance, in the recent ECJ
judgment in Rosneft (discussed here),
which followed a reference from the UK courts, the sanctioned company tried to
reopen the case to argue that the referendum result already meant that EU sanctions
ceased to apply in the UK. The ECJ simply replied that the Russian company had
not explained how the Brexit vote altered the jurisdiction of the Court or the
effect of its judgments.

Of course, the legal position
will certainly change from Brexit Day: the UK government plans to propose a new
Bill regulating post-Brexit sanctions policy in the near future, following a White
Paper on this issue earlier this year (see also the government response
to that consultation). One key question will be whether that Bill already
attempts to regulate the UK’s post-Brexit coordination with the EU on
sanctions, or whether that will be left to the Brexit negotiations to address.

This brings us to the issue of
the ECJ, which is a difficult question as regards many aspects of the Brexit
talks. In principle, in the area of foreign policy and defence, Brexit talks should
not be too complicated by ECJ issues, since the Court has only limited
jurisdiction. However, as the case of Rosneft
illustrates, it does have jurisdiction over sanctions issues. In fact, there
are frequent challenges to EU sanctions and many challenges are successful, so
there will be a risk of divergence between EU and UK policy after Brexit that
may need to be discussed. Such divergence could lead to a knock-on complication
with capital movement between the UK and EU.

The paper also covers development
and external migration policy, where the UK again seeks something which is both
vague and much like membership – collaboration on coordinating policy. While
the EU has its own development policy, Member States are free to have their own
policies, subject to loose coordination – which is what the UK is aiming for as
a non-member.

This was, perhaps, a missed
opportunity here to touch on the most difficult issue in the talks: the financial
liabilities upon leaving in the EU. Some of the EU’s spending in these areas is
not part of the ordinary EU budget (as the ECJ has confirmed),
although it is part of the EU negotiation position. So the UK could have
addressed that issue to move talks along and to make links between ‘upfront’
and ‘future’ issues to get around sequencing problems in the Brexit talks. (The
Prime Minister’s subsequent speech in Florence did not explicitly mention these
funds). Furthermore, the UK government could have used this paper to reassure
some febrile people that it will have a veto on what it chooses to participate
in, as well as on the ECJ.

Internal security: Criminal Law and Policing

In many ways, the government paper
on criminal law matters is similar to the foreign policy paper. It also starts
out by saying how useful the current relationship is, for instance as regards
data on wanted persons and stolen objects uploaded into the Schengen Information
System, the use of the European Arrest Warrant for fast-track extradition, and the
EU police intelligence agency, Europol.

What happens after Brexit? The UK
paper correctly points out that the EU already has agreements in this area with
many non-EU countries, particularly as regards the exchange of policing data
but also as regards some forms of criminal justice cooperation. But as with
foreign policy and defence, the UK wants a distinctive relationship after
Brexit, given the existing close links.

Again, however, the actual
content of what the UK wants is vague. Which of the current EU laws in this
field which the UK has signed up to (for a summary of those laws, see my
referendum briefing here)
would it still like to participate in? The only clear point is that the
government doesn't want direct ECJ
jurisdiction. In principle, that should be fine for the long term, since the
EU27 negotiation position only refers to the ECJ during a transition period. There’s
no insistence on using it afterward, which is consistent with EU treaties in
this field with non-EU countries.

However, some of those treaties
refer to taking account of each other’s case law, and dispute settlement or (in
some treaties) possible termination in the event of judicial or legislative
divergences. The UK paper gives no idea of how it will tackle those issues, whereas
the recent paper on the parallel issue of civil litigation (discussed here)
at least indicated a willingness to require UK courts to take account of
relevant ECJ rulings.

Comments

The contrast between the importance
of these issues and the vagueness with which they are treated is striking.
Imagine a television viewer aching to watch Tenko
or Broadchurch – but having to settle
for Last of the Summer Wine. It is
fair to assume that the government has more detailed plans than this but
doesn't want to release them; but presumably anything more specific would have opened
division in the cabinet or run the perceived risk of making the government look
awkward by disclosing an ultimately unsuccessful negotiation position (what the
government refers to as undermining negotiations). Increasingly these papers
look like an attempt to respond to poor polls about negotiations rather than a
contribution to the talks.

The government does have a point,
however: the UK and EU have significant shared interests in this area, and the
UK has a lot to offer, in terms of its defence contribution, supply of intelligence
and round-up of fugitives from other Member States, for instance. Of course, the
UK benefits in turn from having swifter access to other countries’
intelligence, as well as fast track extradition and transfer of criminal evidence.
The Brexit process might also be an
opportunity to address the civil liberties concerns that sometimes arise about
these measures, but there is no detailed discussion of that.

It will likely be awhile before these
issues are discussed in detail in the talks, and it remains to be seen how
interested the EU27 side is in the UK government’s position. But at first
sight, it seems possible that the future of the EU/UK relationship on security
issues will not be vastly different from the present.

Sunday, 24 September 2017

Compared to famous Florentines,
Theresa May’s recent speech
on the UK’s Brexit plans inevitably owed more to Machiavelli than Leonardo da
Vinci. Nevertheless, it gave a rough indication of the basic legal architecture
that the UK government would like to govern its relationship with the EU for a
transition period after Brexit Day. I have previously summarised
and commented upon the main points of the Florence speech, but there is
more to say on this legal framework – and also on the rules which would apply
to EU27 citizens in the UK during the transition period.

Legal framework

First of all, is a transition
period after Brexit Day even legally possible? If so, what provision of EU law
would apply?

Article
50 TEU, which sets out the basic rules on Member States’ withdrawal from EU
membership, is silent on the issue of any transitional period after the
withdrawal date. However, it might be noted that Article 49 TEU, governing
accession, is equally silent on transitional periods after joining the EU; nevertheless such periods are an established
feature of the accession process.

In its negotiating
guidelines on the Brexit withdrawal agreement, the European Council (EU27 States’ leaders) stated
that:

To the extent
necessary and legally possible, the negotiations may also seek to determine
transitional arrangements which are in the interest of the Union and, as
appropriate, to provide for bridges towards the foreseeable framework for the
future relationship in the light of the progress made. Any such transitional
arrangements must be clearly defined, limited in time, and subject to effective
enforcement mechanisms. Should a time-limited prolongation of Union acquis be
considered, this would require existing Union regulatory, budgetary,
supervisory, judiciary and enforcement instruments and structures to apply.

These principles are set out
again in the negotiation
directives on the agreement, handed down to the European Commission by the Council (EU27
States’ ministers) at paragraph 19. Those negotiation directives go into no
further detail on the transition period issue for now; instead, there will be
further negotiation directives in future, once the EU27 side has decided that
there has been ‘sufficient progress’ on its priority issues (EU27 and UK
citizens’ rights, financial issues, Northern Ireland) during the Brexit
talks.

For the UK’s part, the Florence
speech states that on Brexit Day, the UK will cease to participate in the EU
political institutions. The period must be ‘strictly time limited’, suggesting
‘around two years’; but the two sides
‘could also agree to bring forward’ aspects, such as a new dispute settlement
system. The latter point implies that the ECJ will apply until that point.

Substantively, during the transitional
period, ‘access to one another’s markets should continue on current terms’; the
UK will ‘continue to take part in existing security measures’; and the ‘framework’
will be ‘the existing structure of EU rules and regulations’. There would be no change to other Member
States’ payments and contributions during the current funding cycle (ending in
2020), implying that EU laws on funding and spending continue without amendment
until then.

EU citizens can still come to
live and work during this period, but they will be registered; but as I noted
in the previous blog post, such registration is allowed under the EU
citizens’ Directive. (More on that below). Finally, the speech referred to
one substantive difference in law: the UK would hold its own trade
negotiations, and would ‘no longer directly benefit’ from the EU’s trade
negotiations.

Moreover, the speech made
comments on another aspect of the withdrawal agreement – maintaining EU27
citizens’ rights – that may be relevant by analogy to transition issues. The
Prime Minister said that the UK would ‘incorporate our agreement [on citizens’
rights] fully into UK law and make sure the UK courts can refer directly to
it’; and that UK courts must be ‘able to take into account’ relevant ECJ case
law.

Comparing the UK to the EU27
position on the transitional period, there are lots of similarities. Both sides
are willing to contemplate such a period (the EU27’s ‘legally possible’ caveat
is considered below). Both sides want it to be for a limited time. The Florence
speech states that the transitional rules would be linked with the future
permanent UK/EU relationship (‘a bridge from where we are now to where we want
to be’), matching the EU27 position. (Note there’s no need to define the future
relationship in detail in the withdrawal deal: Article 50 refers only to defining
a ‘framework’ for that relationship, and the EU negotiation position refers
only to bridges towards the foreseeable future framework).

The greatest difficulties may
come with the issues of post-Brexit EU legislation, and the legal effect of EU
law. At present the European
Communities Act provides for the adoption of new EU law into the UK’s
legal order. It gives that law direct effect and supremacy, and gives effect to
ECJ rulings in domestic law. However, the proposed EU
Withdrawal Bill would remove all these provisions, instead retaining
pre-Brexit EU rules and ECJ judgments in force pending potential amendment by
government or Parliament. Pre-Brexit ECJ judgments would retain their force
subject to such amendments or overruling by the UK Supreme Court, and UK courts
would have an option to take post-Brexit ECJ case law into account. The Bill
would also remove the principle of damages liability for breach of EU law, and
would not keep the EU Charter of Fundamental Rights as part of retained EU law
in the UK (on the latter point, see discussion here).

Technically, anything which the
UK agrees to in the Withdrawal Agreement can be incorporated into UK law easily
enough, since clause 9 of the Withdrawal Bill would give the UK government
unlimited power to amend any UK laws to give effect to that Agreement. (Note,
however, that the Bill could be amended in Parliament as regards any of these
points before it becomes an Act of Parliament). So the issue is not the capability of the UK government to give
effect to the Withdrawal Agreement, but its willingness
to negotiate on these issues.

After her speech, the Prime
Minister deliberately avoided answering a question about whether the UK would
apply post-Brexit EU law during the transition period, saying it was a matter
for negotiation. In fact, there is some flexibility on this, since the EU27
negotiation position does not take any view on that point. (Remember that the
EU27 negotiation position on transitional issues will be enlarged later). In
the meantime, UK cabinet members have tried to rule this prospect out. (Note
that the speech refers to keeping ‘existing’ and ‘current’ EU law in force).

There is less flexibility as
regards the legal effect of EU law, where – to recall – the EU27 position is
that ‘existing EU regulatory, budgetary, supervisory, judiciary and enforcement
instruments and structures’ should apply. The combined reference to ‘judiciary’
and ‘enforcement’ structures suggest that the ECJ’s current jurisdiction, and
the current legal effect of EU law in the UK, should apply. While the Prime
Minister obliquely referred to the ECJ, she hoped that its role could be
terminated early as regards the UK; and the UK government’s position on the
legal status of EU27 citizens (no ECJ role; option to take account of ECJ
rulings; incorporation of Withdrawal Agreement into UK law but no special
status), if extended to the transitional rules in the Withdrawal Agreement,
would fall short of the EU27 position. Equally, while it is not expressly
mentioned in the current negotiation position, the EU27 might, when amending
that position, argue that the EU Charter should still apply to the UK during
the transitional period. (Note that the Charter does not apply to all actions
of Member States, but only applies to Member States when they implement EU
law).

Three further points. First, what
happens to the position of non-EU countries as regards the UK? They are parties
to some treaties with the EU alone, and to some treaties with the EU together
with its Member States. The legal issues arising in this respect during the
transitional period will have to be addressed.

Secondly, what happens after the
end of the transitional period? In particular, what if it is deemed desirable
on both sides to continue the arrangement, in whole or part? In that case, the
special decision-making rule applying to Article 50 (see next point) will have
expired, and so the normal decision-making rules of EU law will apply. Depending
on the content of what is carried forward then, this may require some unanimous
voting and even ratification by all Member States, although it should be
recalled that the EU side can decide to apply treaties provisionally pending
national ratification.

That brings us to the most
fundamental legal issue: can the EU27 side include a transitional deal within
the scope of Article 50 in the first place? The words ‘[t]o the extent…legally
possible’ hint at some doubt on this point, presumably because of an argument
that Article 50 cannot extend to the regulation of legal relationships that are
created after Brexit Day, but only to
the regulation and/or termination of those created before that date. However, while little is certain now about how
the ECJ might interpret Article 50, in my view that interpretation is too
narrow, given that Article 50 refers to taking account of the framework for
future relations with the withdrawing state, and Article 8 TEU refers to
maintaining strong relationships with neighbouring non-EU countries. If this is
correct, it follows that as long as the transitional deal is limited in time
and linked to the future framework for relations – as both the EU27 and UK side
intend – there should not be a legal problem. (On the other hand, there is
nothing in Article 50 to require that anything in the withdrawal agreement must
be subject to ECJ jurisdiction, besides the usual rule that only the ECJ can
rule definitively on how to interpret EU law for EU Member States).

The importance of this is that
the Article 50 agreement needs only a qualified majority vote to be approved by
the EU27, without national ratification by Member States (as confirmed in the
negotiation directives). But the EU27 and UK should prepare a ‘Plan B’ in the
event that some Eurosceptic devoted to a ‘WTO-only’ and/or ‘no deal’
relationship between the UK and EU brings a legal challenge. If such a
challenge were successful, the ECJ might anyway maintain the problematic parts
of the treaty in force temporarily due to legal certainty; and the UK and EU
should aim to agree the impugned parts of the Withdrawal Agreement on the
correct legal basis as soon as possible, applying that new treaty
provisionally.

Extension of the Article 50 period

Some have suggested extending the
negotiation period for the Brexit talks instead – as Article 50 expressly
allows for – arguing that a transition phase is no different from extending the
negotiation period anyway. It’s true
that legally the extension of the
negotiation period would be simple: it requires only a unanimous vote of the
EU27 Member States (with no national ratification) required, plus the UK
government, with no role for the European Parliament. As a matter of domestic
UK law, arguably an Act of Parliament would be required to this end (note that
the European
Union (Notification of Withdrawal) Act, which gave the government power
to invoke Article 50 pursuant to the Miller
judgment, does not mention the issue of extension).

But an extension to the
negotiation period would be politically
difficult. It’s not known whether the EU27 would give their unanimous consent,
particularly given the awkward consequence that the UK would then end up
participating in the 2019 European Parliament elections. And within the UK,
announcing an intention to delay Brexit would likely mean that Theresa May
would immediately be the centrepiece of a modern version of Da Vinci’s Last Supper – followed swiftly by the
political resurrection of Nigel Farage.

Furthermore, it’s false to say
that there is really no difference between a negotiation extension and a
transition period. First of all, during a negotiation extension the UK would
still participate in the EU’s political institutions. Secondly, it’s certain
that there would be no change in the legal effect of EU law in the UK or the
substance of EU laws in the UK, and that new EU laws and new ECJ judgments
would continue to apply, in the event of a negotiation extension – whereas
those issues may, as discussed above and below, be addressed differently during
a transition period.

Thirdly, in the event of a change
of mind in the UK on Brexit, remaining
within the EU on the basis of a negotiation extension may be different from rejoining the EU after having left. This
depends (a) on the resolution of some legal issues concerning Article 50 (Can
the withdrawal notice be rescinded? If so, must the EU consent? If so, can the
EU attach conditions? Or can the Article 50 period simply be extended indefinitely, with no further
negotiation taking place?) and (b) on the extent to which the UK could rejoin
on the same terms (Would the EU have already removed the UK’s opt-outs from the
Treaties? Would the UK rebate on the EU budget have been rescinded yet?).

EU27 citizens

As noted already, the UK
government’s intention to require EU citizens to register if they come to the
UK during the transitional period is consistent with the EU citizens’
Directive, which allows registration for stays longer than three months.
Indeed, the Commission has reported
that almost all EU states register citizens from other EU Member States. But a
failure to register can only be punished by proportionate penalties, not
expulsion or detention (see the ECJ ruling in Watson
and Bellman, concerning a prior version of this law). According to the
ECJ ruling in Huber,
Member States may include information on EU citizens in a database, but this
can only be used for the purpose of administering EU free movement law; if they
put information on EU citizens in a criminal database, they must be treated
equally with nationals of that Member State.

The Directive goes on to say that
Member States cannot insist that registration certificates must be the sole
method of checking entitlement to reside or any other right, since other forms
of proving identity are possible; and that Member States can only penalise EU
citizens for not carrying their registration certificates if they penalise
their own citizens the same way for not carrying ID cards (see also the ECJ judgment
in Oulane).
It follows that as long as the UK doesn’t have an ID card system, it could not
penalise EU citizens for not carrying registration certificates.

So while registration of EU
citizens is permissible, the limits set out in the legislation and case law put
the more general questions about ‘transition law’ raised in this blog post in a
particular context. It would not be credible for the EU27 to insist that the UK
not register EU citizens at all,
particularly given that most of them do the same thing themselves. But will the
important limits on registration
apply? It’s an important question given the tendency of the UK Home Office to
create a ‘hostile environment’ for EU and non-EU citizens alike, and the risk
that absent the application of EU case law and legislation to this issue, there
could be fines, detention, expulsion or other refusals of rights for EU
citizens who didn’t register, lost their registration certificate or forgot to
carry it. (All the same issues arise if the UK extends – as it could – the
registration obligation to EU citizens who were present before Brexit Day).

If the EU27 and UK agree that the
existing EU law still applies and the pre-Brexit ECJ case law remains binding,
in principle the issue is resolved, at least during the transitional period.
But what if the UK breaches this agreement, or if there is some question about
how the UK applies the requirement, or if there is some new relevant ECJ case
law? Then the important questions will be whether the existing EU law remedies
(direct effect, supremacy, damages) are still available; whether UK courts can
still ask the ECJ questions; and whether the UK courts are obliged to follow
post-Brexit ECJ case law.

This issue, important as it would
be for many EU citizens resident in the UK, is only a microcosm of the legal
issues raised by the transition period – and which the UK and EU27 will
hopefully have time to consider properly.

Barnard & Peers: chapter 27

Photo credit: Thousand Wonders

* *This blog post was supported
by an ESRC Priority Brexit Grant on 'Brexit and UK and EU Immigration Policy'

Friday, 22 September 2017

Today’s speech
by Prime Minister Theresa May was widely understood to be an attempt to unblock
the talks on the Brexit process, which have clearly become stalled, in
particular over financial issues. Will her speech accomplish that aim? Or will
its implicit attempt to reassure Leave voters in the UK, especially in the cabinet
and the press, mean that it fails to unblock talks? And what does it tell us about
the future of UK/EU relations?

The key
feature of the talks is that they are sequenced. In an initial phase of talks,
the main issues are: a) the position of EU27 citizens in the UK, and UK
citizens in the EU27, after Brexit (discussed here);
b) the extent of outstanding UK commitments to the EU; and c) the issue of the
border between Ireland and Northern Ireland (discussed here).
Only if the EU judges there to be ‘sufficient progress’ on these issues will
the talks move to a second phase, about the future trade relationship between the
EU and the UK and a transitional arrangement to bridge the gap between Brexit Day
and that future arrangement.

As things
stand, the EU will not judge there to be ‘sufficient progress’ in October, mainly
because the UK has not accepted any specific financial commitments, although
there has also been little progress in discussion of the Irish border and there
are still gaps between the two sides’ positions on UK and EU27 citizens.

In that light,
has May’s speech moved the UK closer to reaching the ‘sufficient progress’
threshold? On Northern Ireland, she
simply observed that both sides wanted to avoid a ‘hard border’, but said
nothing new about that. The UK’s proposals on novel customs methods to address
the issue (by the government’s own admission) ‘blue sky thinking’, but she did
not further flesh them out.

On the issue
of EU27 citizens, she committed to
setting out the withdrawal agreement into UK domestic law, and permitting the
UK courts to take account of relevant ECJ case law. But this goes no further
than the draft EU
Withdrawal Bill, which already assumes (in Clause 9) that the withdrawal
agreement will be transposed in domestic law and sets out (in Clause 6) that pre-Brexit
ECJ case law binds lower courts (but not the UK Supreme Court, the government
or Parliament) and that post-Brexit ECJ may be considered at a UK court’s
discretion. While the Prime Minister made much of the excellence and
independence of UK courts, she failed to mention the embarrassing recent refusal
of the Home Secretary to give
effect to a court order. So the EU27 side will still press for the ECJ’s
involvement. Nor did she make any concessions as regards the substance of the
law.

On financial issues the Prime Minister
said in effect that the UK would pay into EU funds to the end of the current EU
budget cycle in 2020, during a transitional period after Brexit Day in March
2019 (see below). She also stated that the UK would honour commitments made
during EU membership, although it is not clear if this is a reference to the
broader issue of the UK’s share of costs in cases where the EU made a
commitment in one year and paid for it in a later year. There are also other
financial issues (off-budget funds, pensions, UK share of liability for loans
that might not be paid).

More broadly, the
Prime Minister supported the idea of a transitional
period after Brexit Day of about two years, when the UK and EU would still
trade on the same basis and apply the same security arrangements. The UK would
still cease to be a formal EU Member State on Brexit Day – ceasing to participate
in the EU’s political institutions – although some role for the ECJ seemed to
be implicitly conceded. It should be noted that the EU27 side is also open to
discussing a short transitional period as long as EU frameworks of enforcement,
et al (including the ECJ) continue to apply. So there is broad agreement on the
notion of a transitional period – subject to discussion of the details.

What about
those details? Mrs May offered little about the substance, stating that EU27
citizens could still come to the UK during the transitional period but would
have to register – as already permitted by the EU
citizens’ Directive (see Article 8). Presumably the UK would have a customs
union with the EU for the transitional period, although she said it would start
to negotiate trade deals with non-EU countries. The transitional period could be
terminated early on specific issues, for instance dispute settlement – an indication
that the UK wants to end involvement with the ECJ as soon as possible.

Comments

Despite the
attention paid to Mrs. May’s speech, the key question is whether the details of
the UK’s negotiation position have changed. In particular, movement on those financial
issues which were not expressly mentioned will be crucial determining whether
talks move forward to trade issues in October. But the issue on enforcement of
EU27 citizens’ rights will still remain a stumbling block, and the EU side will
likely want to see some clarification of the UK’s proposals on customs and the Irish
border.

The tone of
the Prime Minister’s speech may help. It was civil, emphasising the importance
of a future partnership between the UK and the EU, ruling out a rush to lower
UK regulatory standards and with only brief mention of the discredited "no
deal is better than a bad deal" mantra.

If the talks
do move forward to transitional issues, this means there is no immediate need
to discuss the technical questions of winding down UK/EU relations as of Brexit
day, although they would still have to be discussed at some point if the UK and
EU are going to change the substance of their relationship after that date. But
this will mean that difficult issues of principle relating to the transitional
period will have to be discussed.

What exactly is
the transition period a bridge to? Which EU laws (if any) will no longer be
applied? What if the transition time frame isn’t long enough? Would the UK be bound
by new ECJ rulings during this period? Would it apply new EU legislation? Would
the UK be consulted on it if it does? Would EU law apply in the same way as it
does as an EU member? While the Prime Minister was anxious to rule out the ‘Norway
model’ of EU/UK relations, the transitional period would nevertheless look
somewhat like that model – except it appears that the UK would apply even more
EU law than Norway does.

Overall, the
Florence speech makes it somewhat more likely – but still far from certain –
that there will be a conclusion to the Brexit talks, with no immediate ‘cliff
edge’ for either side on Brexit Day. As always, the devil will be in the
detail.

Barnard &
Peers: chapter 27

Photo credit: The
Telegraph

* *This blog post was supported by an ESRC Priority Brexit
Grant on 'Brexit and UK and EU Immigration Policy'

Friday, 15 September 2017

The case of Bărbulescu concerned the extent to which employers could track
employee communications, including Internet use, when those communications
might include private correspondence rather than business communications. Here,
an employer dismissed an employee for failing to respect a prohibition on the use
by employees of work equipment for private reasons. The employee sued his
employer in the Romanian courts but lost, so brought a claim under Article 8
ECHR, which protects the right to private and family life, home and correspondence.
In particular, Bărbulescu objected to the fact that, to find that he had
violated the policy, his employer monitored his communications. This he claimed
was contrary to the jurisprudence of the European Court of Human Rights in Copland
v UK. The Fourth Section of the
Strasbourg court held,
at the beginning of 2016, that the legal situation in Romania did not give rise
to a violation of Article 8. While the media tended to summarise the position
as the court permitting entirely unrestricted monitoring, this was not entirely
the position as noted by Steve Peers here.
The matter was in any event referred to the Grand Chamber and it is with this
judgment that this note is concerned. The Grand Chamber came, albeit not
unanimously, to the opposite conclusion from the Fourth Section, finding that
there had been a violation of Article 8 ECHR.
So, why has it come to this conclusion?

Judgment

The Grand Chamber first
considered the applicability of Article 8 to the situation in issue. Re-iterating a long list of previous cases,
it emphasised that Article 8 should not be understood narrowly and includes
both the right to develop relationships with others and professional activities
or activities taking place in a public context. The Court noted two further
separate points. First it commented that:

[r]estrictions
on an individual’s professional life may fall within Article 8 where they have
repercussions on the manner in which he or she constructs his or her social
identity by developing relationships with others [para 71].

In this context work is important
in providing the possibility for individuals to develop relationships with
others. Secondly, while ‘life’ in the list of interests protected by Article 8 is
qualified by the adjective ‘private’, the term ‘correspondence’ is not so
limited [para 72]. The Court noted that while the test of a reasonable
expectation of privacy has been used to determine the scope of Article 8, it
here re-iterated that is a significant though not necessarily conclusive factor
[para 73]. The Court concluded that while the employee was aware of the ban, he
was not aware of the monitoring; that some of the content was intimate in
nature; that he alone had the password to the account. The Court left open the
question of whether Bărbulescu had a reasonable expectation of privacy in the
light of the employer’s policy (of which Bărbulescu was aware), but then held
that ‘an employer’s instructions cannot reduce private social life in the
workplace to zero. Respect for private life and for the privacy of
correspondence continues to exist …’ [para 80]. Both the right to private life
and the right in relation to correspondence were therefore engaged.

The Court then considered whether
there had been a violation. In this the Court was faced with the question of
whether there was a positive obligation, given that the employer was not a
public body. The Court noted that the monitoring of the communications could
not be regarded as “interference” with Bărbulescu’s right by a State authority
[para 109]. Nonetheless, the measure taken by the employer was accepted by the
national courts, thus engaging the State’s positive obligations [paras
110-111]. It re-stated that the test was that of whether a fair balance had
been struck between the competing interests. The Court noted that labour law
has specific characteristics which allows for a wide margin of appreciation.
This is not, however, unlimited; States must ensure that there are safeguards
in respect of the monitoring of communications. It identified a number of
issues:

-Clear advance notification of the possibility of
monitoring;

-The extent of the monitoring and the degree of
intrusion, taking into account the difference between monitoring ‘flow’ of
communications and their content;

-The justification for the monitoring;

-Whether less intrusive mechanisms for monitoring
exist;

-The consequences for the employee;

-Whether adequate safeguards were in place.

Further, there should be the
possibility of a domestic remedy. The Grand Chamber took the view that the
domestic courts did not consider or did not give appropriate weight to all the
issues identified [para 140]. Notably, it did not appear the employer had given
Bărbulescu sufficient advance notice of "the extent and nature of [its]
monitoring activities, or of the possibility that [it] might have access to the
actual content of his messages". The Court was also sceptical of the
national courts acceptance of the justification for the intrusion. There was
therefore a violation of Article 8.
There was dissent, however, on the assessment of the national courts’
approach to the matter.

Comment

The headline news from this is
that the Grand Chamber came to a different determination on the issue of breach
from the Fourth Section. It should be noted, however, that even that chamber
did not suggest that unlimited monitoring would be permissible (see e.g. Steve
Peers’ analysis). Nonetheless in purely practical terms, the Grand Chamber
judgment provides a clear statement that workplace privacy cannot be reduced to
zero, as well as a list of considerations that will be useful not just for
national courts but also employers in considering policies regarding personal communications
in the workplace. Note that this case concerned a private employer not – as in Halford
and Copland – a public body as
employer so the considerations highlighted will be of relevance to all
employment relationships. In this, the Grand Chamber seemed to respond to some
of the concerns expressed by Judge Pinto de Albuquerque in his dissent from the
Fourth Section judgment regarding the factual specificity of the case. The
judgment also seems to recognise the importance of work as part of daily life,
an important point given the blurring of boundaries in the ‘always on’ culture
of smart devices in which work-related information and communications co-habit
with those of life outside work.

There are some further points to
consider. The first is the scope of Article 8 and in particular the ‘reasonable
expectation of privacy’. Article 8 lists
a number of aspects protected: ‘private and family life’ – usually seen as two
separate elements ‘private life’ and ‘family life’ – ‘home’ and
‘correspondence’. As written, it seems that these are distinct elements yet the
reasoning of the Court does not always treat them as separate; arguably the
Court’s previous approach in making the matter one of a ‘reasonable expectation
of privacy’ blurs any boundaries between these elements and in so doing, limits
the scope of protection as far as ‘correspondence’ is concerned. The Grand
Chamber seemed alive at least in some regards to this point: it specified that
there is no requirement that correspondence be private. If that is the case, however,
why is the issue of reasonable expectation of privacy relevant? Indeed, the
Grand Chamber noted that the test of reasonable expectation of privacy is not
the be all and end all of Article 8 (see para 78). Despite this recognition, the
Grand Chamber still turned the question into one of a reasonable expectation of
privacy:

It is open to
question whether – and if so, to what extent – the employer’s restrictive
regulations left the applicant with a reasonable expectation of privacy [para
80].

Is the Court here suggesting that
correspondence is protected by Article 8 only when there is a reasonable
expectation of privacy? Seemingly so, yet the Grand Chamber continued to state:

…. an
employer’s instructions cannot reduce private social life in the workplace to
zero. Respect for private life and for the privacy of correspondence continues
to exist, even if these may be restricted in so far as necessary [para 80].

The position is consequently
somewhat unclear. It would be more straightforward were the Court to recognise
that correspondence constitutes a separate class aside from private life
however broadly understood, and to deal with scope of Article 8 as a separate
issue from that of interference and justification. The current position unfortunately seems to be
embedded in a long line of case law.

Bărbulescu is distinct from previous case law on employee
monitoring in that it involved the State’s positive obligations. The Court has
tended to adopt a different approach in regard to positive obligations than
negative obligations. Rather than look at Article 8(2) and the tests of
legitimate objective, lawfulness and necessity (in a democratic society), it
adopts a fair balance test within which the State has a broad margin of
appreciation. On this basis, the side-lining of the Copland ruling – which fell at the lawfulness stage in a standard
Article 8(2) analysis – is understandable.
The Court seems to suggest, however, that there are parallels between
positive and negative obligations:

[i]n both
contexts regard must be had in particular to the fair balance that has to be
struck between the competing interests of the individual and of the community
as a whole, subject in any event to the margin of appreciation enjoyed by the
State [para 112].

It is questionable whether the
derogation from an individual’s rights by state actors really should be seen as
being about a fair balance, a stance which arguably nudges the focus of
protection away from human rights as paramount. Nonetheless, here the Court
brings in factors from the standard Article 8(2) state surveillance case law aimed
at preventing abuse of secret surveillance capabilities to provide guidance in
finding the fair balance. It is noticeable that Copland is not considered but
instead the State surveillance cases of Klass
and Zakharov.

It might be that the Grand
Chamber accepted the referral because it wished to deal with failure of the
Fourth Section to consider the EU
Data Protection Directive, which protects against the collection of personal
data without the explicit consent of an individual (or justified grounds for
such collection). This point was
highlighted by Judge Pinto de Albuquerque. If so, the judgment fails to engage
with EU data protection law in any meaningful way. The Grand Chamber noted that
the national courts had considered the directive, but did not consider those
rules themselves. Insofar as the Court does refer to international and European
standards, it specifies the ILO
standards and Council
of Europe Recommendation CM/Rec(2015)5, rather than the Directive. It seems
then that there has not been any direct engagement with the substantive EU data
protection rules.